Newtmitch

**Name of the Vulnerable Software and Affected Versions** Node.js versions 18.x through 23.x **Description** A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. **Recommendations** For Node.js versions 18.x, 20.x, 22.x, and 23.x, consider implementing a workaround to handle abrupt socket closures and invalid headers to prevent memory leaks. As a temporary workaround, consider disabling the use of HTTP/2 until a patch is available. Restrict access to the nghttp2 module to minimize the risk of exploitation. Avoid using the `nghttp2` library in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.